Could Your Router be Infected with Malware?

Could Your Router be Infected with Malware?

Certain threats out there are dangerous enough to cause major entities to warn against them. In particular, a recent malware by the name of VPNFilter has been deemed dangerous and prevalent enough that the FBI has addressed it. Since the malware targets routers (probably not your first guess in terms of possible vulnerabilities), it has considerable potential to become a nuisance for your organization.


Understanding VPNFilter
VPNFilter is a malware that hides in your router and remains even if you restart the device. VPNFilter is known for prioritizing devices in Ukraine, but you should never count on the trend to protect you from known threats. It’s thought that the VPNFilter malware has its roots in a group called Sofacy, and the malware operates in three basic steps.

The first step for this malware is that it installs itself on the device and remains there even in the event that the router is rebooted or turned off. Second, the malware will install certain permissions on the router that allows it to change settings, manage files, and execute commands. The router can then proceed to brick itself, making it much more difficult for your organization to keep operations moving along. In its final stages, this malware lets a hacker see the data packets that are being sent to and from your organization’s device, meaning that they can then also issue commands and communicate with the device via a Tor web browser.

This threat was specifically mentioned by the FBI because of its persistence. While resetting the device will disable the second and third steps, the first will remain, creating an endless cycle if you don’t do anything about it.

Is Your Router Affected?
Even though not all routers are affected, the number is still quite considerable. Here is a list of affected brands:

  • Asus
  • D-Link
  • Huawei
  • Linksys
  • MikroTik
  • Netgear
  • TP-Link
  • Ubiquiti
  • Upvel
  • ZTE

If you would like a more comprehensive list of all affected devices, Symantec has a list on their website: https://www.symantec.com/blogs/threat-intelligence/vpnfilter-iot-malware

How You Fix It
There is an easy fix to VPNFilter, and it’s to perform a factory reset on your router. This eliminates anything that’s currently installed from the first stage of VPNFilter’s attack. Of course, it’s also worth mentioning that the manufacturer of the router may have also administered a patch or security update resolving the vulnerability, so be sure to check for that as well so that it will never be an issue again.

For more great updates and tech tips, be sure to subscribe to White Mountain IT Services’s blog.

Related Articles

  • Identifying Personality Types will Help Your Networking Effo... One experience that almost everyone has been involved in is the clashing of personalities. This is only natural, as different people are born with different predispositions and are raised in differing environments. However, in the business world, one should do their best to keep personal differences...
  • Mobile Botnets Make the Internet Even Less Secure Technology is often exploited by hackers for their benefit, but one avenue of attack that’s consistently neglected is the mobile device. Smartphones and tablets are arguably at greater risk than desktops and workstations due to them being exposed to more wireless networks. One of the greatest threat...
  • The Average Cost Per Data Breach Hits $4 Million If you ever question why your business needs to take advantage of network security and all of its components, consider this fact: the average cost of data breaches, worldwide, has increased by 29 percent since 2013. Believe it or not, the average cost per data breach is now an astounding $4 million!...
  • 3 Common Threats You Need to Know About: Malware, Rootkits, ... Security is one of the most important parts of running a business, especially today when organizations rely so heavily on their technology solutions. Some of the most dangerous threats lurk on a business’s network, watching and waiting for an opportunity to do some real damage. With the right preven...
  • Honor Among Hackers? Not for Those Who Hack Hospitals It’s safe to say that hacking is a frowned-upon practice, but that hasn’t stopped cyber criminals from attempting to turn a profit off of it. This practice has led them to target nonconventional organizations, including hospitals and other healthcare facilities. However, just because a hacker can ta...
  • Alert: New Malware Infects Millions of Mobile Devices While security experts tend to focus the brunt of their discussions on desktop OS vulnerabilities, there are plenty of mobile malware threats that fly under the radar. One such malware is called Hummer; a trojan that installs unwanted apps and malware on a device, and can be found on over a million ...
With the surge in the number of small and medium businesses that have fallen prey to malware and cyber criminals, there is a lot of focus of what an organization can do to prevent being a victim and how the company should handle themselves after an attack. There is another key factor to preventing cyber criminals from penetrating into your network:...

- Onsite Service Coverage Area -

Onsite Computer Support Services are available to businesses within 100 miles of Nashua New Hampshire. We have excellent onsite coverage from Concord NH, south through Manchester NH and then down into Boston. From Northern and Central Mass we cover from Worcester, east to the North Shore, including the Salem and Portsmouth NH area.

 

603-889-0800

White Mountain IT Services
33 Main Street Suite 302
Nashua, New Hampshire 03064

 

 padlock1  Cyber Security Toolkit

cloud desktop2 Cloud Desktop Login

Open Positions